USB connections exposed as 'leaky' and vulnerable

[Batu69]

TESTS on USB connections have shown they are highly susceptible to information “leakage”, making them less secure than previously thought.

 

Researchers from the University of Adelaide in South Australia tested more than 50 different computers and external USB hubs and found that more than 90 per cent of them leaked information to an external USB device. The results will be presented in Canada at the USENIX Security Symposium in Vancouver next week.

 

Project leader Dr Yuval Yarom, Research Associate with the University of Adelaide’s School of Computer Science, said it had been thought that because USB-connected devices only sent information along a direct communication path to the computer, it was protected from potentially compromised devices.

 

He said USB-connected devices were the most common interface used globally to connect external devices to computers and included keyboards, cardswipers and fingerprint readers, which often sent sensitive information.

 

“But our research showed that if a malicious device or one that’s been tampered with is plugged into adjacent ports on the same external or internal USB hub, this sensitive information can be captured. That means keystrokes showing passwords or other private information can be easily stolen,” Dr Yarom said.

 

Dr Yarom said this “channel-to-channel crosstalk leakage” was analogous with water leaking from pipes.

“Electricity flows like water along pipes – and it can leak out,” he says. “In our project, we showed that voltage fluctuations of the USB port’s data lines could be monitored from the adjacent ports on the USB hub.”

 

The leak was discovered by University of Adelaide Computer Science student Yang Su in collaboration with Dr Daniel Genkin (University of Pennsylvania and University of Maryland) and Dr Damith Ranasinghe (Auto-ID Lab, University of Adelaide). The tests were conducted in late 2016 and early this year.

 

The team used a modified cheap novelty plug-in lamp with a USB connector to “read” every keystroke from the adjacent keyboard USB interface. The data was sent via Bluetooth to another computer.

 

Dr Yarom said other research had shown that 75 per cent of USB sticks dropped on the ground were picked up and plugged into a computer. But they could have been tampered with to send a message via Bluetooth or SMS to a computer anywhere in the world.

 

He said Bluetooth was a more secure way of transferring information.

“We wanted to understand better what things are secure, what things are not and what risks people might be facing,” said Dr Yarom, who will attend the symposium in Vancouver from August 16-18.

 

“The main take-home message is that people should not connect anything to USB unless they can fully trust it.

“For users it usually means not to connect to other people devices. For organisations that require more security, the whole supply chain should be validated to ensure that the devices are secure.”

 

Dr Yarom said the long-term solution was a redesign of USB connections to make them more secure.

“The USB has been designed under the assumption that everything connected is under the control of the user and that everything is trusted – but we know that’s not the case,” he said.

 

“The USB will never be secure unless the data is encrypted before it is sent.”

South Australia’s capital Adelaide has three long-standing public universities, Flinders University, University of South Australia and the University of Adelaide, each of which are consistently rated highly in the international higher education rankings.

 

Article source

 

[straycat19]

On 8/24/2017 at 10:11 PM, Batu69 said:

“Electricity flows like water along pipes – and it can leak out,”

 

Really?  I think this was discovered back in the early 60s with data carrying lines.  Matter of fact I know it was because at the time those lines had the voltage on them decreased to 6 volts so the emanations ceased to exist.  Even without that security measure, the leeching line had to be laid next to the line that carried the data that was being hacked.  So on a USB device, that carries not more than 12 volts, you would need additional cables or wires on a large electrical plate in the desktop that could capture the data emanations.  In other words, if you check the area you are working in and there are no wires on top of the desk next to your usb device and you don't see a large metal plate with wires under the desktop there is no way those electrical emanations will travel far enough to be captured by anything or anyone.  Did you know that your logins and passwords could be stolen by a person standing behind you when  you typed them in or by a person with a long range telescope that could see your desktop from another location, even inside a library or coffee shop?  So maybe you should only access your sites with a dark colored heavy shroud covering your head and monitor while working on your computer so no one could spy on you.  I'm being facetious, but I hope you get the point.

[steven36]

If they or you  plug  a hacked device  into  you're computer all kinds of evil stuff  could  happen too you  this is just conman sense ..If you pick up a flash drive off  the ground and take it home and plug it in that makes you a  idiot  too.  Some more James Bond 007  techniques  were they have too come into  you're office and plug in a spying device  .

 

Quote

 

Practical test

They did a practical test to prove that their theory is possible. For this, they used a small lamp that connects by USB. They modified their connector in such a way that it was able to record each press on an adjacent keyboard also connected by USB. All this data that the lamp collected was sent to a computer via Bluetooth.

They add that it is not at all difficult to attack users in this way. They assure that a great percentage of users connects USB ports of random form without knowing really its origin. For example at work. Simply plug in a USB stick to print a document. We can not assure that this is not modified in any way with which to collect data of another device that we have connected.

 

https://techviral.net/usb-port-leaking-personal-data-hackers/

 

There is much easier ways for a hacker too harvest you're data  Microsoft  ,Google ,Facebook,  etc.  do it everyday  and everyone volunteers for it too use there free and paid software and services.  People talk  and type into  AI  and walk around with a smart phones  witch have a built in tracking device  in there pocket  now days and you're worried about someone plugging in spyware into you're  USB? We already know the world is full of fools and all this research does is remind us of it. The Government is already tapped  into everything you do via these big tech companies  . And if you have someone planting  spyware USB devices around you're work you have way more problems than  spyware ..

 

This article here was wrote   in 2014 Why the Security of USB Is Fundamentally Broken And I read about it in 2014 as well

https://www.wired.com/2014/07/usb-security/

 

Quote

Implementing that new security model will first require convincing device makers that the threat is real.

 

We already know USB can be hacked  for a longtime here it is 2017 now and no one has done fudge all too fix it yet. Vendors  don't think the risk is big enough too improve there security  so all these researchers are doing is wasting time and money some really bad breeches would have too happen via USB before they would fix it.